Depends on which application your user access review is being performed . Like for my company most of the data was in database in encrypted format so i simply used the same , with the expiry column . So if say a access is expired we will simply trigger a mail to the right party .
------------------------------
------------------------------
Vipul Tiwari
Senior Process Simplification and Optimization Designer(Solutions Architect)
Fidelity International
------------------------------
------------------------------
------------------------------
Vipul Tiwari
Senior Process Simplification Developer
Amazon
------------------------------